RHELU4 versus RHELU5
Steve Grubb
sgrubb at redhat.com
Thu Feb 8 17:33:09 UTC 2007
On Thursday 08 February 2007 12:06, Kirkwood, David A. wrote:
> Is the auditing used in RHEL4 update 4 a dead end with respect to either
> RHEL4 update 5 or RHEL5?
Within RHEL4, they are very much the same. But some improvements with each
release. Between RHEL4 & 5, the user interfaces at the program level are the
same. The audit utilities understand the same parameters, audit.rules has the
same syntax, etc. The API at the library level has changed somewhat due to
new capabilities in RHEL5 and the kernel.
> The reason for the question is that I need to write some scripts or
> graphical programs to tie some of the pieces together to construct
> meaningful auditablity for disjoint items. If I have to do this all over
> again, are the items going to be the same or completely different or
> somewhat the same?
Between RHEL4 & 5 they are mostly the same. I'd have to know exactly what you
are trying to do to answer it, but we've worked hard to preserve the same
command set. IOW, "audit -w /etc/shadow -p wa" runs on each platform. The
audit records are slightly different format, but contain nearly the same
information.
> I can use the system as it is now, but I would have to run many ausearches
> and / or aureports with different parameters to get the information I want.
> When I need to look at 10's of systems, it is much easier to consolidate
> everything into a combined output and view the whole thing.
This is the area that we are working in right now. RHEL4U5 has a realtime
interface which can be used for log aggregation. We are starting to turn
attention to that and should start fleshing something out in the coming
weeks.
-Steve
More information about the Linux-audit
mailing list